Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

vwu.ai Sihai Models

Call and interact with vwu.ai Sihai models including sihai-i2v-31, sihai-image-27, sihai-t2v-29, and sihai-tts-25 with OpenAI-compatible API.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 20 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description (call vwu.ai Sihai models) match the included script and SKILL.md. However the registry metadata lists no required environment variables while SKILL.md and vwu-chat.sh clearly require VWU_API_KEY (and optionally VWU_BASE_URL). This mismatch is an incoherence between declared requirements and actual needs.
Instruction Scope
SKILL.md and the shell script only instruct the agent to call vwu.ai's API and print responses — no broad system access is requested. Caveats: the script prints the first 8 characters of VWU_API_KEY in some error cases (information leakage), and it expects jq and curl (and uses a zsh shebang) though no binaries are declared.
Install Mechanism
No install spec or remote downloads — this is an instruction-only skill with a bundled shell script. No external code is fetched at install-time, which limits supply-chain risk.
!
Credentials
The skill uses an API key (VWU_API_KEY) and a base URL; those are proportionate to the described purpose. However the skill metadata does not declare the required VWU_API_KEY, and the script reveals the first 8 characters of the key on quota errors. Also it assumes jq/curl availability without declaring them.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent system privileges. It doesn't modify other skills or system-wide settings.
What to consider before installing
This skill appears to implement what it claims (calling vwu.ai models) but has a few issues to consider before installing: - The package metadata claims no required env vars, but SKILL.md and the script require VWU_API_KEY (and may use VWU_BASE_URL). Expect to provide an API key. - The bundled script prints the first 8 characters of your API key on certain API errors — while partial, that is an information leak you may prefer to avoid. Consider editing the script to remove that line before use. - The script uses curl and jq and has a zsh shebang; ensure those binaries are present and that running a zsh script is acceptable in your environment. - The skill's source and homepage are unknown; if you don't trust the owner, verify the script and confirm the vwu.ai endpoint before providing credentials. Recommended actions: ask the publisher to update metadata to declare VWU_API_KEY as a required env var, remove printing of API key fragments, and document binary requirements (curl, jq). If you accept those caveats and trust vwu.ai, the skill is functionally appropriate; otherwise do not install or run without reviewing/modifying the script.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
aivk97ewjec64p55v3tz9n914q8pn8318v5latestvk97ewjec64p55v3tz9n914q8pn8318v5llmvk97ewjec64p55v3tz9n914q8pn8318v5sihaivk97ewjec64p55v3tz9n914q8pn8318v5vwuvk97ewjec64p55v3tz9n914q8pn8318v5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

sihai Models for vwu.ai

vwu.ai 平台上的 sihai 模型调用技能。

支持的模型

  • sihai-i2v-31
  • sihai-image-27
  • sihai-t2v-29
  • sihai-tts-25

共 4 个模型。

配置

使用前需要设置 vwu.ai API key:

export VWU_API_KEY="your-key-here"

获取 key: https://vwu.ai 控制台

使用示例

# 调用模型
vwu-chat --model sihai-i2v-31 "你的问题"

API 兼容性

所有模型兼容 OpenAI API 格式,支持标准 chat completions 接口。

额度提示

如果使用时提示"额度不足"或类似错误:

  1. 访问 https://vwu.ai
  2. 在控制台充值或调整额度
  3. 或生成新的 API key

由 Claw 自动生成 | 源数据: vwu.ai

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…